cdd463deaf1b359c6a9783018dbef8c7f3ccd53410662ec490eeb27cb47e1409

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 02:25

Target

43ec7dd7222314b3a3218fe877008847_JaffaCakes118.dll
Size

13KB
MD5

43ec7dd7222314b3a3218fe877008847
SHA1

2d69e062bf11ced127fa042216229da4008ca1c7
SHA256

cdd463deaf1b359c6a9783018dbef8c7f3ccd53410662ec490eeb27cb47e1409
SHA512

febe20c69eacd6b5c03585d4df95fe10389b9e92783efd4ddc872d2f854c0f4b88835766d41ec0df957e6e6557ce5be8dd9ba83e594fc4b216ef823c6e0b528b
SSDEEP

192:mkIv6TzCWOHIiMIqd+XmmQ9c0hrk1xMgzsdXndG0gQPz9tcFxtJObRzQoFlkJKIV:DFPiY+XmQ0yOgzUXnhb92rtQqqlkJ8Q

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2264	2272	regsvr32.exe	30
PID 2272 wrote to memory of 2264	2272	regsvr32.exe	30
PID 2272 wrote to memory of 2264	2272	regsvr32.exe	30
PID 2272 wrote to memory of 2264	2272	regsvr32.exe	30
PID 2272 wrote to memory of 2264	2272	regsvr32.exe	30
PID 2272 wrote to memory of 2264	2272	regsvr32.exe	30
PID 2272 wrote to memory of 2264	2272	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\43ec7dd7222314b3a3218fe877008847_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\43ec7dd7222314b3a3218fe877008847_JaffaCakes118.dll
  2⤵
  PID:2264